Pipelines | Use per-package APIScan name/version pairs

[paulmedynski]

Description

Each of our NuGet packages is now registered with APIScan under its own name/version pair, so this stops attributing every scan to the single global Microsoft.Data.SqlClient / 6.10 registration.

• Reinstates the per-job ob_sdl_apiscan_softwareName and ob_sdl_apiscan_versionNumber variables in build-buildproj-job.yml. The name comes from the existing packageFullName parameter (already constrained to exactly the registered names); the version comes from a new required apiScanSoftwareVersion parameter passed from build-stages.yml.
• Removes softwareName/versionNumber from the globalSdl.apiscan blocks in both the official and non-official pipelines, so the build job template is the single place the pair is specified.
• Replaces the ApiScanSoftwareVersion variable with ApiScanVersionSqlClient (7.1) and ApiScanVersionSqlServer (1.0). This branch targets the 7.1.0 release. These stay runtime $(...) references because a template expression coerces a quoted version to a number, which would turn '1.0' into 1 (the same failure mode that previously turned '6.10' into 6.1).
• Disables APIScan on validate-signed-package-job. It is a Windows job that installs and inspects an already-built package, produces no assemblies, and was silently relying on the global registration that no longer exists.
• Updates the SDL section of the OneBranch pipeline design instructions, which still claimed break: false "pending package registration" and listed the wrong APIScan folder paths.

Name/version pairs reported by this branch:

Package	APIScan version
Microsoft.Data.SqlClient	7.1
Microsoft.Data.SqlClient.Internal.Logging	7.1
Microsoft.Data.SqlClient.Extensions.Abstractions	7.1
Microsoft.Data.SqlClient.Extensions.Azure	7.1
Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider	7.1
Microsoft.SqlServer.Server	1.0

The APIScan version tracks the major.minor of each package's NuGet version, so a new pair must be registered with APIScan before we release a new major.minor.

Issues

Implements the main (7.1) portion of AB#46589 — Register new APIScan name/version pairs.

The remaining branches are tracked separately and are not covered here:

• AB#47834 — SqlClient release/7.0
• AB#47835 — SqlClient release/6.1
• AB#47836 / AB#47837 / AB#47838 — SNI 5.2 / 6.0 / 7.1

Testing

Pipeline-only change; there is no product code to unit test.

Validated with a full non-official OneBranch run against this branch: sqlclient-non-official 26246.1 — succeeded, all stages green, no failed records.

All six build jobs ran 🛡 Guardian: APIScan and passed the expected registered pair:

Job	--software-name	--software-version
SqlClient	Microsoft.Data.SqlClient	7.1
Internal.Logging	Microsoft.Data.SqlClient.Internal.Logging	7.1
Extensions.Abstractions	Microsoft.Data.SqlClient.Extensions.Abstractions	7.1
Extensions.Azure	Microsoft.Data.SqlClient.Extensions.Azure	7.1
AlwaysEncrypted.AzureKeyVaultProvider	Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider	7.1
SqlServer.Server	Microsoft.SqlServer.Server	1.0

Notably Microsoft.SqlServer.Server passed --software-version 1.0, not 1, confirming the runtime $(...) indirection prevents the numeric coercion that would otherwise produce an unregistered pair.

Scan coverage is as intended: the six build jobs scanned, and the four jobs that produce no assemblies (version extraction, SDL sources analysis, agentless tag, finalize build) did not, so removing the global name/version left nothing unattributed. Each job also picked up its own apiScan/<package>/dlls and /pdbs folders.

Also verified locally that all modified YAML parses and that no references to the removed ApiScanSoftwareVersion variable remain.

Not covered by this run: validate-signed-package-job does not execute in the non-official pipeline (there is nothing signed to validate), so the ob_sdl_apiscan_enabled: false added there is untested. It mirrors the existing publish-symbols-job pattern, but it only takes effect on the official pipeline and would benefit from a reviewer's eye or an official dry run.

• Public API changes documented — n/a, no API change
• Ensure no breaking changes introduced

[Copilot]

🔵 Needs a closer look

Correctness depends on external APIScan registrations and a successful OneBranch validation run.

Pull request overview

Updates OneBranch pipelines to attribute APIScan results to each NuGet package’s registered name/version pair.

Changes:

• Adds per-package APIScan names and versions to build jobs.
• Removes global APIScan identity settings and disables scanning for package validation.
• Updates OneBranch pipeline documentation.

File summaries

File	Description
eng/pipelines/onebranch/variables/onebranch-variables.yml	Defines SqlClient and SqlServer APIScan versions.
eng/pipelines/onebranch/stages/build-stages.yml	Passes registration versions to all package builds.
eng/pipelines/onebranch/sqlclient-official.yml	Removes the global APIScan identity.
eng/pipelines/onebranch/sqlclient-non-official.yml	Removes the global APIScan identity.
eng/pipelines/onebranch/jobs/validate-signed-package-job.yml	Disables APIScan for the validation-only job.
eng/pipelines/onebranch/jobs/build-buildproj-job.yml	Configures each build job’s APIScan identity.
.github/instructions/onebranch-pipeline-design.instructions.md	Documents the per-package configuration.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[cheenamalhotra]

Can we use the same version number variables instead? That will push us to register the new versioned products before we can update product versions.

[paulmedynski]

Done!

[Copilot]

🟡 Changes recommended

The default SqlServer build derives APIScan version 1.1, conflicting with the documented registered 1.0 pair.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 1
• Review effort level: Balanced